The purpose of
this paper is to review the worldwide historical structural failure data in the
1990s on offshore structures, and compare this with the present risk analyses
of Norwegian offshore structures.
The paper
describes an overview of registered accidents to offshore structures based on
the databases WOAD and CODAM. The accident data is given for fixed platforms,
jack-ups and for floating platforms. Estimates of risk level in annual
frequencies and PLL values are given for each platform type.
The paper
concludes that:
·
The risk connected to marine operations and structures
give a significant contribution to the total risk.
·
The
historical risk to marine operations and structures is significant higher than
the results from risk analyses.
·
Neither component nor system based reliability
analyses of structures give adequate descriptions of the real risk connected to
structures.
·
Human errors are probably the dominating cause of
accidents connected to structural failure.
Introduction
This work was initiated as a part of the
project to evaluate the development of the safety on the Norwegian Continental
shelf. We have counted the number of incidents related to 24 different
indicators during the period 1996-2000. A safety index for the Norwegian
Continental shelf is calculated. To get one index the different types of
incidents (as fire, kicks, collisions and major cracks in structures) have to
be given a weight based on its relative importance to the fatality risk. Vinnem
et al (2001) give more details and conclusions of the project.
In Norwegian risk analyses structural failure
turn up with an insignificant contribution to the risk in the industry. The
risk analyses are normally giving results in accordance with reliability
analyses, dealing only with intrinsic and inherent uncertainty. In general,
these reliability analyses give risk contributions from structures which is at
least an order of magnitude lower than what is found from blow-out and process
risk assessments. On the contrary, structural failures in UK risk analyses (DNV
Technica, 1995 and Sprouge, 1999, page 155) give a significant contribution to
the total risk.
Reliability
analyses are generally used for risk analyses, risk
based inspection programs, code calibration, risk based design and
reassessment of structures. In this paper only the use connected to risk analyses will be discussed.
In this paper we will present a historical
risk to structural failure in general, based on worldwide statistics. The
contributions to the historical risk statistics are dependent of the type of
structure, and due to this we will continue by reviewing each type of
structure. The next step will be to look into what results reliability analyses
is giving, and compare these with the historical data. Based on this we will
argue that the use of reliability analyses results in a risk analyses is
questionable.
Data sources used in extracting the historical risk
Incidents
and accidents on platforms on the Norwegian continental shelf are to be
reported to Norwegian Petroleum Directorate (NPD). NPD compile the information
for use in statistics and analysing trends. For this purpose the CODAM database
is applied. The database contains information such as incidents, inspection
findings and specific installation data. Data has been recorded from the mid
1970s. Initially the database was designed for jacket structures and pipelines,
but later adjustments have made it suitable for all types of installations. CODAM is
an in-house database for and maintained by NPD, but the recorded information is
available for public use upon request. Incidents and
inspection findings are classified into one of three severity levels:
Insignificant, Minor or Major.
CODAM is an
in-house database for and maintained by NPD, but the recorded information is
available for public use upon request. The most
recent publication on the incidents reported in CODAM related to structures is
given in Hamre et al (1991) and Leonhardsen et al (2001).
The world
offshore accidental database (WOAD) is used to give a worldwide reference (DNV Technica, 1995).
The data in the base are classified as insignificant, minor, major, severe and
total loss. In this review, only data classified as severe or giving total loss
of the installation, are used. This classification is used for severe damage to one or more modules
of the unit; large to medium damage to load carrying structures, major damage
to essential equipment (as BOP, wellhead, riser or X-mas tree), toppling or
sinking of fixed units, capsizing or sinking of mobile units and collapse of
drill derricks. We have used the data restricted to the period
1990-1999. Funnemark (1997) gives the most updated review of the WOAD data.
Ten accidents
are reported from Norway as "severe" and ”total loss”. We have an average in the 1990s of
about 110 platforms. On a world basis there is about 8.000 installations with
174 serious incidents. Based on a direct comparison scaling between the
Norwegian data and the worldwide data, a rough assumption may be that less than
one third of the worldwide serious incidents are reported. The data coverage in
WOAD for different causes is not randomly distributed. Sprouge (1999)
discusses the representativity of WOAD. From our interpretation the database
gives a relative overrepresentation of incidents related to structures,
collisions and blow out incidents. For process, riser and pipeline related
incidents the WOAD data are more limited, and mainly restricted to published
data.
It can be argued that some types of platforms
are not relevant, or that something irrelevant for Norway was included in a
marine operation. Similar arguments may be used also for blowouts and process
accidents. To get an understanding of the frequencies and to describe the
relative contributions the number of cases declared irrelevant should be
handled similarly in all disciplines. New techniques, materials and barriers
have also made some of the older incidents irrelevant. It has been important for us to
evaluate the structural events for its relevancy to Norway. The other events
have been kept unchanged. This is believed to a conservative approach for our
purpose. Major incidents
related to structural failure in Norway has been the loss of Frigg DP1 jacket
during installation 12.10.1974, the capsize of the flotel Alexander Kielland
27.3.1980 causing the death of 123 men, the capsize of the jackup West Gamma
21.8.1989 and the loss of the concrete gravity structure Sleipner A-1
23.8.1991. Based on the large number of incidents we cannot claim the
structural safety level in Norway is significantly different from the worldwide
average.
The
experienceD risk FOR offshore platforms worldwide 1990-99
The causes of all incidents
reported in WOAD for the period 1990-99 are shown in figure 1.
The hurricane Andrew is an important event in the 1990s (for
details see Wish, 1992, Daniels, 1993 and Kareem, 1999). The hurricane occurred
in1992 in the Gulf of Mexico. The return period for the waves were somewhere
between 25 and 100 years (Kareem et al, 1999). It is appropriate to ask whether
the large number of incidents in this hurricane relevant for Norway?
The API RP-2A got a major update in the end of the 1960s. The
requirements to structures were significantly increased (Sprouge, 1999). A
similar level of safety has been required from about 1970 up until present.
Platforms built before 1970 might be regarded as not relevant for Norway as all
platforms on the Norwegian continental shelf are made after 1970, and not
according to API requirements from the1960s. 23 platforms built after 1970 were
significantly damaged (Sprouge, 1999, page XI.6), and these will be denoted as
“relevant” cases in the following. Different numbers for how many platforms
built after 1970, occur in the literature. Also the number of damaged platforms
in the hurricane varies. We have selected to use the data from Sprouge (1999).
It should also be mentioned that the safety factors in API for ultimate limit
state controls are slightly higher than required in Norway, but this may not
lead to an increased safety level on “API” jackets as the variability of the
weather is larger in this area. Norwegian platforms designed after 1984 (36 of
67 jackets) also have to be checked against an environmental load with annual
probability of 1*10-4. Prior to this, 31 jackets were designed with
similar deck clearance as in the Gulf of Mexico. The hurricane Andrew was the
largest hurricane in the Gulf of Mexico during the period 1970-2000, but also
other hurricanes have caused damage in this period (Sprouge, 1999).
Figure
1: The causes of all reported
severe or total loss incidents in WOAD for the period 1990-99. No reduction in
any causes has been made.
In order to
give a conclusion to the question asked: To select the relevant cases for risk
assessment in Norway will be subjective, but we have tried to do it. Some of
the structural types might also not be relevant for Norway. Many of the
incidents in the Gulf of Mexico might have caused fatalities in Norway, as
people are evacuated from the platforms in the Gulf of Mexico during extreme
weather, while we normally do not evacuate.
The
probability of a significant incident caused by a structural failure on
location, during transportation and installation has for the period 1990-99
been in the order of magnitude 11*10-4 pr
platform year. So far, the data have been presented independent of structure
type. In the following sections, these data will be divided according to
structure type (fixed steel and concrete, jack-up and floating platforms).
Fixed
steel and concrete PLATFORMS
Most
of the fixed steel structures damaged in the hurricane “Andrew”, are classified
as wellhead structures or satellites. Some of them might be relevant for
Norwegian unmanned platforms, but we do not have sufficient information to
evaluate them in this regard. Twelve platforms are categorized as jackets in
WOAD and suffered "severe damage". Just one jacket was installed
later than 1970. The deck of the platform was severely damaged, but the jacket
was not. A substantial contributor was that the deck was never fully welded to
the jacket at the connections and the deck was basically pushed off the top of
the jacket. We have not had the possibility to study all the events in detail.
Even if only one event would be strictly relevant, we have as a rough estimate
for the statistical treatment, assumed two of the hurricane “Andrew” events to
be relevant.
The
accidents connected to installation of fixed steel structures are the tilting
of a jacket, possibly due to a mudslide, a toppled jacket during installation,
due to problems with the mud mats, one having pile foundation error, one with
tilting of the drill tower and one lost a module during lifting. Only the drill
tower accident caused loss of lives.
Sharples
et al (1989, page 114) have for the 1980s structural “mishaps” of fixed steel
structures as about 5% of the total number of “mishaps”, but they also have a
significant “other” group. A direct comparison is not easy. Bekkevold et al
(1989) have from the 1980s, structural damage as the cause in 4% of the total
losses to fixed platforms, and 7% in the 1970s. They also have a significant
number of “other incidents”. The frequency from the 1990s is similar to the
previous periods. As discussed above for the WOAD data coverage, these numbers
are probably an upper bound on the relative importance of structural failure.
The total number of jacket type structures is
unknown to us. Most likely the structural failure probability of 7*10-4
pr platform year for any fixed steel platform will be on the conservative side
for the jacket structures. Disregarding most of the
hurricane Andrew events the conclusion must be that the in place risk for fixed
structures is rather low. The installation phases though give significant
contribution to incidents.
For fixed concrete platforms there are two incidents
in WOAD, one fire on the topsides and the sinking of Sleipner A-1. The number
of events and platform-years is to low to be used to give a
reasonable risk estimate based on historical data
Figure 2: Relative distribution of “relevant”
cases of incidents in WOAD for fixed steel structures in 1990-99. The total
number of relevant cases is 29.
Jackup
platforms
Sharples et al (1989) have
reported “mishaps” on jackups for the period 1979-88. A comparison of causes
with the 1990s, gives similar results of the relative severity as demonstrated
in figure 3. Incidents connected to marine operations and structures are in
both periods dominating the incidents statistics. About half of the risk is connected
to the installation and transportation.
Figure
3: The causes on jackup platforms
of “mishaps” in Sharples et al (1989) for the period 1979-88 and “severe/ total
loss” in WOAD in the period 1990-99. Sharples et al (1989) had 227 cases. The
WOAD data contains 27 cases.
For the Norwegian continental
shelf the worldwide data have to be evaluated for relevancy. The use of jackups
in Norway is limited because our water depths are from 65m and upwards. We have
had a few cases of soil related problems in Norway in the category less than
severe. Punch-through is when the jackup is standing on a stiff soil
(frequently sand), and because of loads or scour the leg is penetrating through
the layer and into a softer soil (frequently clay). Two similar incidents have
been reported in Norway. In January 1995 one of the legs of West Omicron sank
1.5m. In 1990 Kolskaya experienced scour around one of its legs. If the storm had lasted longer or had higher
waves, punch-through could have been the result. Fine graded sand was on top of
soft clay. The worldwide jackup soil incidents are assumed to be relevant.
A structural accident probability
of 35*10-4 pr platform year for jack-ups is experienced. Incidents related to structures are the dominating
cause of failure on jack-ups. The failure probability is significantly higher
than for other fixed structures.
FLOATING
platforms
The
number of events on floating platforms is lower than for the other types of
structures, but the number of platforms is also lower. The following incidents may be mentioned:
Barges for drilling and work over have had one loss due to sinking and two blowouts.
Drill ships have had one collision and one loss of riser.
One FPU have had a severe riser leakage.
Using
all the WOAD data on barges and ships related to the petroleum industry for the
1990s, the frequency of sinking has been 9*10-4 pr platform year, but the number is very
uncertain because of the low number of events and platform years. Experience with
tankers worldwide (Sprouge, 1999, page XI.27) demonstrates that an annual
probability for sinking of tankers above 10.000 dwt during the period 1972-86
is 3*10-4 per tanker. Tveit (1998) has found a total loss of tankers
above 50.000 grt worldwide for the period 1970-90 of 8*10-4 caused
by failure in structures, ballast and mechanical systems.
The
lack of seaworthiness is probably more comparable with “severe” in WOAD, than
the number of sinking tankers. A ship undertaking production will have less
possibility to leave the location than is the case for ordinary ships, because
of its fixed connection to the production risers. An annual probability of
18*10-4 pr tanker that the ship is not seaworthy because of damage
to the hull has been found (Sprouge, 1999). The frequencies for grounding, war
damages and collisions are not included in the numbers. A
production ship being on a fixed location will have a higher risk from wave
loading than merchant ships caused by the loading pattern being more or less
the same all the time with the ship heading towards the weather (Sprouge,
1999). In addition
failures in station keeping, heading control and frequent use of the ballast
system also add up to give a higher expected failure frequency of production
ships compared with merchant tankers. Up to 1999 the ship shaped platforms in
Norway had to comply with a set of safety factors, but higher than traditional
tankers. This was changed in 1999 to accept the maritime rules and regulations,
and at the same time accepting a higher risk. The risk associated with tankers
will be relevant also for future field developments.
For
the semis there are only two events in the WOAD database in the 1990s, - one
under towing and one with a damaged heave compensator as the initiating events. With only one relevant structural event it
is not sufficient to calculate a risk number for semis with any reasonable
accuracy. The losses of Aleksander Kielland and Ocean Ranger in the 1980s
visualize the inherent risk also for these platforms. Sharples et al (1989,
page 108 and 118) demonstrate that the relative number of “mishaps” on semi
submersibles was higher than for any other type of structure. The dominating
causes of “mishaps” are related to mooring and transit. Bekkevold et al (1989)
had the complete opposite conclusion. They concluded that the semi submersibles
had a far better safety record than the other types of mobile units. In Norway,
semi submersibles are designed with higher safety factors than ships, and also
have to comply with Norwegian Maritime Directorate stability regulations, being
stricter than the International Maritime Organization requirements.
HISTORICAL RISK VERSUS RELIABILITY
ANALYSES AND RISK ANALYSES
Component based reliability analyses of structures frequently concludes
that structures have an annual probability of failure (typically a crack) of
the component in the order of magnitude 1*10-4 (as in Fjell, 1977 and Moan 1995). The
method is characterised with a known or assumed bias, coefficient of variation
and the statistical distributions of actions and strength. This is the inherent
probability if all the technical requirements to the components are met with
respect to correct design, crack detection and correct geometry. The most
important shortage in these analyses is the analyses of purely individual
components and the lack of incorporation of human errors.
System reliability analyses of fixed steel structures give
typically an annual probability of failure of the platform in the order of
magnitude 1*10-5 for each failure mode (as in Snell, 1996). The
analyses are typically performed by non-linear structural analyses taking into
account the behaviour of the steel above yield. For a redundant system the
component reliability is a lower limit of the system reliability. As for the
component reliability analyses these analyses do not model human errors.
In order to estimate the total probability of failure of a
structure, a large number of failure modes are relevant, as waves hitting deck,
overloading, fatigue, earthquake, corrosion, soil failure, installation,
ballasting failure, towing and position keeping system failure. Calculating the
probability of failure for a structure based on such a list of failure modes
will sometimes be a lower bound solution. There will in most cases be failure
modes that are not included, due to underestimation, insufficient knowledge and
unknown influences. We have counted the number of reported cracks on jackets in
Norway in the period 1976-2000. The experienced annual probability of getting a
crack is calculated to be about 35*10-4 for each node and member in
the jackets. Cracks in conductor frames are not included. The probability of
finding cracks is significantly higher than what would have been the case if
the component analyses give a correct picture. If one compare the historical
frequency of anchor chain failure with the failure rates found in reliability
analyses for semi submersibles a similar large discrepancy is found
(Leonhardsen et al, 2001). We expect similar results to be obtained for other
types of structures, but without doing this exercise.
The number of platform-years in Norway is limited. As described
previously, we have had four incidents with total loss of platforms. The
experienced accidents in Norway have a very high frequency (26*10-4 per
platform year), but as demonstrated before, - even higher than the worldwide
statistics (severe or worse incidents) for the period 1990-99. A system
reliability analyses of a fixed steel structure gives typically an annual
probability of failure of the platform in the order of magnitude 1*10-5
for each failure mode, - higher for some modes, and lower for others. These
numbers are far away from the experienced frequencies of events, both in Norway
and worldwide.
A conclusion must be that neither a component nor a system based
reliability analyses of structures give an adequate description of the real
risk connected to offshore structures. The next question must then be why?
As an attempt to answer this question, we will look into the
influence of human errors to structural failures.
Human Errors
In general three types of risk exist (Bea, 1996)
a)
The inherent or natural variability.
b)
The uncertainties with the calculation methods,
c)
Errors performed by individuals, groups or organizations (human errors)
Reliability analyses as performed for offshore structures covers
only the first two uncertainties. Are the major discrepancies found between
calculated risk and experienced frequencies of severe events caused by human
errors?
The experience from our four major structural accidents in Norway,
demonstrates that human errors is the most important contributor. Matousek and Schneider (1976) and Schneider
(1997, page 14) summarize an investigation of 800 cases with major damage on
onshore structures. The risk modelled in our reliability analyses contributed
to only 10-25% of the total risk. Human errors contributed with 75-90% of the
accidents. It is likely to assume that a large part of the discrepancies between
the experienced frequency and the calculated risk can be explained by human
errors, also for offshore structures.
To evaluate the probability of human error for a specific project
is not a straightforward task. Several authors have presented methods to
evaluate the risk in the design phase. The probability of getting a
significant error in structural analyses was found to be 20*10-4 (Paté-Cornell, 1990), 30*10-4 (Bea, 1995b) and
90*10-4 (Trbojevic et al,
1996). Bea (1995a) correlates human errors to how familiar the task is, stress,
time available, distraction and impairments.
Paté-Cornell (1990) evaluates the effect of an additional
quality control. The detection probability varies depending on who are
performing the review, and the severity of the error, - from 1% to 80%.
Schneider (1997, page 15) found that a thorough discipline check would have
found about 32% of the errors and an additional check (as independent
verification) would have found about 55% of the errors. Applied on the
Norwegian cases additional checks were made for Frigg DP1 and Sleipner A-1, but
it still passed through the verification. Discipline checking and
verification are useful tools for removing human errors, but they reduce the
risk only to a limited extent. Using the calculated failure probabilities and
the reduction obtained by quality control activities, a failure rate similar to
the experienced failure rates are obtained.
Other aspects of human error are errors in fabrication and
installation, and unknown phenomena connected to new types of structures and
use of structures outside its previously experienced environment.
FATALITY RATES
In
the NPD risk project (Vinnem, 2001) we have based our evaluation of changes in
expected fatality rates. Statistics of the numbers of fatalities based on WOAD
is very sensitive to a few events and the time period studied. If we had
prolonged the database to 1980 the accidents with Piper Alpha, Ocean Ranger and
Aleksander Kielland would have been included.
To
get an overview of the consequences of major incidents related to structures we
have to review the WOAD database information with respect to the number of
fatalities and the number of rescued in “severe” and “total loss” accidents.
WOAD only describe twelve cases where the number of fatalities and the number
of rescued are given. In a few cases it
is said that all the people were safely rescued, but without stating how many,
indicating that the numbers presented here should be a conservative estimate.
In these twelve cases 52 people were lost and 897 rescued, giving a probability
of fatality of about 5%. The number of fatalities on the Norwegian Continental shelf caused by
our four major structural incidents is 123, giving a fatality frequency of 46%.
For the 1990s the number of events and the number of fatalities for structural
events seems to have about the same relative importance.
Conclusions AND SUMMARY
1.
Using
the worldwide statistics for the period 1990-99 and the experienced frequencies
for ”severe” or ”total loss” for structural events, the structural events
should not be disregarded in the formal risk analyses.
2.
The
experienced annual failure probability have been found to be in the order of
magnitude 7-35*10-4, and is dependent of the type of structure in
question.
3. Neither
a component nor a system based reliability analyses of structures give an
adequate description of the real risk connected to structures. Human errors are
not modelled, and based on the difference on the result from these analyses and
the historical data, human errors are probably the dominating cause of
accidents connected to structural failure.
4. It is necessary to improve the methodology of
how the risk of structures is handled in risk analysis.
This
work has been performed as a screening exercise to evaluate the use of present
Norwegian risk analysis as a tool to describe the real risk of offshore
structure. To get a reasonable weighting between the different causes, we have
for our project used the results as described by DNV Technica (1995) – as
giving the most realistic representation of the structural contribution.
ACKNOWLEDGEMENT
We have discussed the content of this paper at different stages
with several people. Direct input to the paper have come from Mike Prins,
Malcolm Sharples, Sverre Haver, Jan Erik Vinnem, Ove Tobias Gudmestad, Ivar
Langen, Espen Funnemark, Per Rosengren, Bjørn Ringstrøm and Odd Johannes Tveit.
We thank those named and also those not mentioned here!
REFERENCES
Bea Robert G: Quality, reliability, human and
organization factors in design of marine structures, OMAE volume II,
Copenhagen, 1995a.
Bea Robert G: Evaluation of human and
organization factors in design of marine structures: approaches & applications,
OMAE volume II, Copenhagen, 1995b.
Daniels Gerald R: Hurricane Andrew’s impact on
natural gas and oil facilities on the outer continental shelf, interim report
as of November 1993, MMI, Herdon, USA, 1994.
DNV Technica: World offshore accidental
database, release 4.11, Høvik, 1995
DNV Technica: An overview of risk levels in the
offshore industry on the UK Continental shelf (1994), HSE Offshore Technology
reports OTH 94 458, HMSO, London, 1995
Fjell Svein: Reliability of offshore
structures, OTC 3027, Houston, 1977
Funnemark Espen: Review of 20 years of
worldwide offshore accidents, WOAD technical report no 2, DNV, Høvik, 1997.
Hamre Reidar, Arne Kvitrud and Kåre Tesdal: In
service experience of fixed offshore structures in Norway, OMAE, Stavanger,
1991.
Kareem Ahsan, Tracy Kijewski og Charles E
Smith: Analyses and performance of offshore platforms in hurricanes, Wind and
structures, volum 2, no 1, 1999.
Leonhardsen Roger L, Gerhard Ersdal and Arne
Kvitrud: Experience and Risk assessment of FPSOs used on the Norwegian
Continental Shelf, ISOPE, Stavanger, 2001.
Matousek Miroslav and Jørg Schneider: Untersuchungen zur Struktur des
Sicherheitsproblems bei Bauwerken, Institut für Baustatik und Konstruktion, ETH
Zürich, Bericht nr. 59, 1976.
Moan Torgeir: Target safety level for
reassessment of North Sea offshore platforms, Sintef report STF70 F95201,
Trondheim, 12.01.1995.
Paté-Cornell M Elisabeth:
Organizational aspects of engineering system safety: The case of offshore
platforms, Science, volume 250, pp. 1210-1217, 30th November 1990.
Schneider Jørg: Introduction to safety and
reliability analyses, IABSE, Zurich, 1997.
Sharples B P M, W T Bennett Jr and J C Trickey:
Risk analyses of jackup rigs, International conference on the jack-up drilling
platform, Singapore, 1989.
Snell R O: Safety levels across different
structural forms and materials, BP, London, 1996.
Sprouge John: A guide to quantitative risk
assessment for offshore installations, The centre of marine and petroleum
technology, Aberdeen, 1999.
Tveit Odd J: Risk
management approach to FPSOs in Statoil, FPSO Symposium, Bechtel Tower,
Houston, March 9-10, 1998
Vinnem Jan Erik, Odd Tveit, Dag Sande, Einar Ravnås, Øyvind Lauritsen and Arne Kvitrud: , NPD, April 2001
Wisch Dave: Hurricane Andrew
structural performance information exchange, API meeting transcript, October
29, 1992, API offshore standardization committee fixed systems sub-committee,
Houston, 1992.